What’s Vulnerable › Vulnerabilities

CVE-2019-13352

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-07-05 · updated 2026-06-17
• Weakness: CWE-798

Description

WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing this static secret and the corresponding algorithm for calculating support PINs, an attacker can reset the ADMIN password and thus gain remote access.

Affected products

• Wolfvision Cynap: before 1.30j — fixed in 1.30j

How to fix

Upgrade to a fixed version: Wolfvision Cynap 1.30j. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html
• http://seclists.org/fulldisclosure/2019/Jul/9
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt
• http://packetstormsecurity.com/files/153530/WolfVision-Cynap-1.18g-1.28j-Hardcoded-Credential.html
• http://seclists.org/fulldisclosure/2019/Jul/9
• https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2019-021.txt

Get alerted when CVE-2019-13352 or the next vulnerability affects your stack